��k�d6U;銐0�����GäSZ]��oM���R��,"�'�n�`���|k�C�K��� F���4�}\y�WRdh �1�ɻ[unӅ0�냎8YT^O`�!�ɻ'@����?} ����P�_�7�%�K�� ��8�B>�.��� �m<�V��6<w�\D���/�N�gK���a���5�D��P������U6�a\j~H��y��4��w-;���<v��I.-�=�zF[:����vK��$���s;�e�1d��&R�Ka-���FB2U�M�L+,���G�#cx�K��Y��mQ�8C0���My������V�`�m�����IQ����u�����oe6p4���&s""ٲ\]Url'��-Z�6��ژ��}��;K���<Gy,�m��1�igF�ه�:g;��T��U�WC������>�h�e[�Kp��~��Ȝ?���ѵ��W��2l��ND�������'�I|[b�I�#�0�2�����R)�W.��*L2�q++:傐�|1Tz�\�����A@��ʰfZk<�_4�Ҧ9c�n� ~>,F���\P�jU�����"BFʭyf[���ݒ�N���>x�j��y�T��sY��#2�X�u��z�`,r_���b�Q,[������nV�����97pg�j)[�W������Iۋ6��`����I<.Di�yAE���Y �ŌS�(Ѳ�������=�ܞ�+���).H�<B������N��ƽ�����-� ���=*D�(� �^ ��z��^^��'b�]�BUB�t��8��X�¥�M����C��Ʉ��9P|ެ'���J�2o��7�6�2��?��}��!H�$��O�c�L$�i[C�w�w|��(����K(����U�F t\="�Y��X���.���[�L n�<Ȼ*F�TM;I5Lg4��Mo�؇���)��7&�ڞ��.(q�k�+�W�l���KOTk���؊���qtq�w�����Y��.� *��Ņ*S��L�aȴoM�_�����uJ� 橓��F@��K���_b$M��#N��t}k1\J:[��,ܻ�F��%��ݞ*Y�z9F�!u4�<�.y�n'�z�3���uU��9s���g���2j+�_�ƐEU�+~M�v�gHPw;��=�`����"ȉhl�+��E*>�C.�� ��O��S�����~zߖ5_?��qZ�|����E ��8����S�;Z��]z�çV����,mp�w�Sd���~:(�>�`{+!^n����|��)���$hKI�Όș"/�ZǛ��5HM�̧KTi��w�v�.�E1�k�6��T�s�s�������R�[Y5����8��Հ��q.^�fUTe|J*��At)���j�M)Ikl�2ѥ���#o�<��6Fh�z� �f(�\w;���"\cf!�#�s�.x�2m�)��C��im��j�!�y�i#z ���*�������l�k�Xd��/������.D����w[Z���t��wTp�N"�'0��a@�����C��+�����48�<ˉ�u�a uw|h#��:����,y~�A:#�WD�c���ð{'D�31aH�� ����#l�E����S`2��T��6,گ��dE�Hz�}V*����cɪO�s�f���H�ĺ=�$F��y]7(�hB��{=ȷCɜ�,���j j �������Sm70���rMLY�6oS�����UP���F�m�n�,����,L����'���r"0~�@��w��̠7�����7�[�3߽R�a����4��y��Ÿ)��o�O8�� �P[(�������kv��O?[�}�wm�maCUʭ'W6͖I&#��ߨ@X�*�`�N���V�A��hUIu�0���((��iUo����g큷�A۹~�70/jp�9!��*��|�j�`f���j���dj�)��2(�UFF��ueݴ>�)�tRU�8����1P�(�Oyf%����%&|��� +���x��!���F͞�����ɉ��w�*Y���F�e�y;d0�¹`��7��֧����G9�%M�����t��U=��B'S��/5�;���3���BoWwL����h��T,M����kR�`��_���<�� �>8'�&��퉘�:�5�N���:D >u�$��2=+��zZ�D��α�n�/2� ��Φ�[I$�$�����j�O����s@"��ay�չ9�`3�����lL&.��T/�O���xF��{BT��b��@ہ�̜,s�i.^p��n��m�܇�G/���@xs"ƶ9��܄ڊ�i=�S _��U��7B�څ=�2 ]V ��/��!��Wu��}�?;��xD�IP�}F��|�Cim�������:}��g H�Υ���ޢ�OU�q`@e�̟�Y�0-i��6I%�7��Su�4��_��'�oVD#z��gJU�Wh6�� ��%%z�9.M'������+���`AL5]�3?��k��϶��N���`a�+3�Ѷ�*�F�1!��B����~X�λ1n13V�����D���C�{�EA� �~���F�'��S�mzO�#1�1�9�B[�f���^o|�qm�O�<d�Ac#?�Q��w�l��x��q�Q�]1�;�LS¹ g(��"��f9��L#P;M�a�8|�#$Ǵ�Mr2P�#x�6��u�*j�/�@Q5�t!+~�{���E�J{H�9r��x5�HUͭ�ikS�41��/q���B/��Ba�%~��8(�̫2�.�i�d���נ�͕�'��7W0B圞f3i���Y3�h��T�������ň,����u�ZזD�0�)�O���9����Wt1=��k��-��|P\`\������j[H;�1�P������ˠC�oK(�)��R�=t}n����'ܝN���ѭ�����[�k!X֘h#�� ��A�V��c��"ڀLl�������M������~|�L@����g��8[�ys�Zx� �*&�������� ���:A�͢��>��h�3�Cՙ�I+�k]MYkoF��J�#�ɖ�({�|�2y�m,�
Static task
static1
Behavioral task
behavioral1
Sample
Principal_1.exe
Resource
win10v2004-20230915-en
General
-
Target
Principal_1.exe
-
Size
15.0MB
-
MD5
e0d061f238f28f513cf0d2f7fa2fe30d
-
SHA1
dc1c7793d4f49858aeecc32d4ce3ce7595193871
-
SHA256
3d9f9872211376cb6f84f089ceaba15414500a0db0aef22404010eeca4aa9c39
-
SHA512
ccf3a4f28f2f08ba8931407bdf6e7101c3ca02daff96ff4995f66a0ecf33f6eb6f8b2abb50ca96f31754879da67956d31dc1560bd79bf7111c6bb9c7d54610be
-
SSDEEP
196608:fF9mefxmshgZwhrfi8OU5uNZ7EBaFr3adZTjYhdcrrcbpFU0FK5dg1o1W91XX:N9messCaDiQK7vFraUhd+cppydg1W+X
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Principal_1.exe
Files
-
Principal_1.exe.exe windows:6 windows x64
2c7e8cfe9eb247b417652b28f6159d32
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VerSetConditionMask
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
urlmon
URLDownloadToFileA
normaliz
IdnToAscii
wldap32
ord45
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
api-ms-win-crt-stdio-l1-1-0
_popen
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-string-l1-1-0
isupper
api-ms-win-crt-convert-l1-1-0
strtol
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_stat64
Exports
Exports
Sections
.text Size: - Virtual size: 423KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 102KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ziM Size: - Virtual size: 12.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.5^0 Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.)=p Size: 15.0MB - Virtual size: 15.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 208B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ